SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Users on the same VLAN report that their browser occasionally reaches a fake internal portal, and packet captures show one host sending forged ARP replies that claim to be the default gateway. Traffic from nearby systems begins flowing through that host. Which attack is occurring?
⚠ Common exam trap
Candidates often confuse ARP spoofing with DNS poisoning because both can redirect traffic to a fake portal, but the key differentiator is the protocol layer: ARP operates at Layer 2 (MAC address manipulation) while DNS operates at Layer 7 (name resolution).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ARP spoofing
B is correct because the scenario describes ARP spoofing (also known as ARP poisoning). The attacker sends forged ARP replies to associate their MAC address with the default gateway's IP address, causing traffic from other hosts on the same VLAN to be redirected through the attacker's machine. This allows the attacker to intercept, modify, or redirect traffic to a fake internal portal, which is a classic man-in-the-middle (MITM) attack leveraging the stateless nature of ARP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS poisoning
Why it's wrong here
DNS poisoning corrupts a DNS resolver's cache or a server's zone data, causing users who query a domain name to receive a malicious IP address, often for phishing or traffic redirection. However, this attack relies on forging DNS responses (typically UDP/53) and occurs before the TCP connection is established, not by sending ARP messages on the local subnet. In this scenario, users' browsers are intermittently redirected because the attacker is issuing fake ARP replies that bind the gateway's IP to the attacker's MAC address, which is a local link-layer event independent of DNS resolution. Therefore, DNS poisoning cannot explain the observed forged gateway ARP replies, whereas ARP spoofing directly matches that evidence.
- ✓
ARP spoofing
Why this is correct
ARP spoofing (also called ARP poisoning) works by sending unsolicited ARP replies—or replying to ARP requests—on the local Ethernet segment, falsely claiming that the attacker's MAC address corresponds to the default gateway or another host's IP. The victim's ARP cache is then poisoned, so unicast traffic intended for the gateway is forwarded to the attacker instead, enabling man-in-the-middle interception, tampering, or sniffing. This perfectly explains intermittent browser misbehavior on the same VLAN, since the poisoned ARP entries expire and the attack can be replayed. The forged gateway ARP replies are the definitive indicator that separates ARP spoofing from the other options.
- ✗
MAC flooding
Why it's wrong here
MAC flooding exploits the finite size of a switch's content-addressable memory (CAM) table by sending thousands of frames with random source MAC addresses. Once the table is full, the switch falls back to hub-like flooding, broadcasting frames destined for unknown or legitimate hosts to all ports. However, this technique aims to capture traffic by breaking switch isolation; it does not generate forged gateway ARP replies or manipulate any host's ARP cache. The scenario's ARP cache poisoning indicates a malicious host deliberately answering ARP requests, which is the signature of ARP spoofing, not MAC flooding.
- ✗
SYN flood
Why it's wrong here
A SYN flood is a denial-of-service attack that exploits the TCP three-way handshake by sending a barrage of TCP SYN packets with spoofed or nonexistent source IP addresses, causing the target to allocate half-open connection state and exhaust its backlog queue. This attack disrupts availability at the transport layer and neither involves L2/L3 ARP messages nor redirects a host's gateway traffic. Because the reported symptom is forged ARP replies on the local VLAN, the attack must be operating at the data-link/network boundary, which a SYN flood does not touch. Thus, while both are malicious, SYN flood lacks the ARP manipulation described.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Man-in-the-Middle Attacks
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
ARP poisoning
ARP poisoning is a network attack where an attacker sends fake Address Resolution Protocol messages to link their MAC address with a legitimate IP address, enabling them to intercept, modify, or stop data on a local network.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.